In the last year, the world's critical infrastructure - the medical, power, communications, waste, manufacturing, and transportation equipment that connects people and machines - has been under near-constant attack, according to Forescout.
Exploits against software libraries are witnessing a decline due to the waning popularity of Log4j exploits.
This lull has given rise to a surge in exploits targeting network infrastructure and Internet of Things devices.
Among the IoT landscape, the spotlight falls on IP cameras, building automation systems, and network-attached storage, emerging as the most sought-after targets for malicious actors.
Persistent attacks on OT. Only 35% of exploited vulnerabilities made an appearance in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list.
This divergence emphasizes the need for a proactive and comprehensive approach to cybersecurity, transcending reliance on known vulnerability databases.
Operational Technology finds itself under relentless assault, with five key protocols bearing the brunt of persistent attacks.
The primary targets include protocols used in industrial automation and power sectors, such as Modbus, subject to a staggering one-third of all attacks, closely followed by Ethernet/IP, Step7, and DNP3, each accounting for approximately 18% of the onslaught.
IEC10X rounds out this list with 10% of attacks, leaving the remaining 2% distributed among various protocols, with BACnet emerging as the majority.
Building automation protocols, such as BACnet, experience less frequent scans.
The relative scarcity of scans belies an alarming trend-targeted exploits against vulnerabilities in building automation devices are more prevalent.
While most observed commands used by threat actors remain targeted at generic Linux systems, a notable trend involves specific commands executed for network operating systems found on widely used routers.
The Agent Tesla Remote Access Trojan commands a significant 16% share of observed malicious activity.
Following closely are variants of the Mirai botnet, comprising 15%, and the Redline info stealer, holding its ground at 10%. Half of all threat groups linked to China, Russia, and Iran.
Among command-and-control servers, Cobalt Strike emerges as the undisputed leader, commanding a substantial 46% share, trailed by Metasploit at 16%, and the emerging Sliver C2 at 13%. Most of these servers are in the United States, constituting 40% of the global landscape, with China and Russia following at 10% and 8%, respectively.
Threat actors have cast a digital net far and wide, impacting 163 countries.
The United States stands as the primary target, bearing the brunt with 168 malicious actors setting their sights on the nation.
The usual suspects boast high concentrations of threat actors: China, Russia, and Iran, collectively representing nearly half of all identified threat groups.
The crosshairs of these malicious entities are predominantly fixed on three key sectors: government, financial services, and media and entertainment.
As the primary pillars of societal infrastructure, these industries are at the forefront of cyber warfare, emphasizing the need for heightened security measures and collaborative efforts.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Mon, 29 Jan 2024 05:13:04 +0000